System and method for collecting and storing event data from distributed transactional applications

ABSTRACT

Event data associated with state data corresponding to an instance of a process is collected by an interceptor associated with a server that performs an operation to modify the state data. The server performs a single transaction with the database to store both the modified state data and the associated event data, the transaction either succeeding or failing, whereby if the transaction succeeds, then both the state data and the event data are stored at the database, and if the transaction fails, then both the state data and the event data are not stored at the database. The event data stored at the database is then transmitted to a tracking service for conversion into a query-able format.

BACKGROUND OF THE INVENTION

[0001] 1. Field of the Invention

[0002] The present invention relates to distributed transactional applications such as business process orchestration technology, and, more particularly, to collecting tracking data corresponding to an instance of a business process managed by the technology.

[0003] 2. Description of the Prior Art

[0004] Distributed transactional applications are applications that run in a distributed environment and persist the state of the application data in a server in a transactional manner. An example of a distributed transactional application is business process orchestration technology, which enables the automated management of multiple instances of business processes. A business orchestration product such as, for example, the BIZTALK software application from MICROSOFT corporation of Redmond, Wash. allows a user to quickly design, define, and deploy automated business processes that span programs, technologies, platforms, and business partners. For example, a user may create a business process corresponding to the process of determining whether a borrower is approved for a loan. The business process may include the steps of receiving a loan application, sending for an appraisal, receiving an appraisal, sending for a credit history, receiving a credit history, and obtaining final approval, among other things.

[0005] For each instance of a process, data corresponding to the state of the instance is stored by a database. When the state of an instance is to be changed, a server performs an operation to modify the data in the database corresponding to the state of the instance. For example, the database may store state data indicating that, for an instance corresponding to the loan application of Jim Smith, a credit reporting agency has been contacted and is in the process of preparing a credit report. When the credit report has been received, a server performs an operation to obtain the state data corresponding to the instance from the database and modify the state data to indicate that Smith's credit report has been received. The server then performs a transaction with the database to store the modified state data for the instance at the database.

[0006] One of many advantages of automated management of business processes is that a user can monitor and respond to events occurring across multiple instances. These may include events such as, for example, service start, end, and error information, message in and message out metadata information, and debugging and trace data and message bodies. For each event, corresponding event data is gathered. This event data may be used to alert the business to an error or problem within an instance or across instances or to notify the business of a required action or response. Additionally, detailed event data may be used to compile a comprehensive report on the history and real-time state of any instance of a business process. Thus, it is important that business process orchestration technology provide detailed event data in an efficient and reliable manner.

[0007] Furthermore, it is often desirable to analyze and manage event data in a format that is easily comprehended and manipulated. A user may wish to analyze event data according to various attributes corresponding to the events. These may include attributes such as, for example, the type of event, the time at which the event occurred, and the instance to which the event corresponds. In addtion, a user may wish to create hierarchies within each attribute. For example, a user may wish to analyze events according to the time at which each event occurred and to group each event according to the date on which it occurred. Data grouped according to date may also be sub-grouped according to, for example, the hour on which it occurred.

[0008] Business orchestration technology generally collects event data during the course of performing an operation to modify state data corresponding to an instance of a process. In existing technology, event data is committed to storage at the database upon its collection. A drawback of committing to store upon collection, however, is that a single operation may fail multiple times before the operation succeeds. This is because a server may, for example, crash or lose its connection with the database before the operation is fully performed. Upon failure, the operation is typically transferred to another server which again attempts to successfully perform the operation. Thus, event data corresponding to a single event may be collected multiple times by different servers and stored multiple times at the database. Multiple storage results in multiple data entries for a single event, thereby creating several “false” error alerts or “false” entries in a process report or history.

[0009] Existing technology is also limited in that it does not enable a user to select the events corresponding to which he or she wishes to collect data, thereby filling the database with irrelevant and/or unwanted event data. Thus, the user is forced to disregard unwanted alerts and to manually filter out unimportant events from a report or history. Furthermore, existing technology does not enable event data to be analyzed and managed in a format that is easily comprehended and manipulated. In existing business process orchestration technology, event data is stored in a serialized data stream that is not formatted for analysis according to the attributes of the event data.

[0010] Thus, a need exists in the art for a system and method for collecting and storing event data from distributed transactional applications that commits event data corresponding to an operation on an instance of a process only after the operation on the instance succeeds. Furthermore, a system and method is needed that enables a user to collect data corresponding to events that are pre-selected by a user and that presents the event data in a format that enables users to easily analyze the data.

SUMMARY OF THE INVENTION

[0011] Accordingly, in the present invention, a system and method for collecting and storing event data from distributed transactional applications is disclosed. Data corresponding to the state of an instance of a process is stored at a database. When the state of an instance changes, a server performs an operation to modify the data corresponding to the state of the instance. During the course of the performance of the operation, an interceptor collects event data associated with the modifications to the state data. After the operation has been successfully performed, the modified state data and the associated event data are committed to the database in the same transaction.

[0012] Event data stored at the database is transmitted to a tracking service. The tracking service converts the event data into a form storable in a query-able database and stores the converted data. Event data in the query-able database includes data corresponding to a plurality of event items, and the data is stored according to the instance to which the event item corresponds and also according to the operation. In one embodiment, event items corresponding to an instance are organized according to a plurality of data tables, where each table represents an attribute of the data. Furthermore, data may be organized according to plurality of dimensions, wherein each dimension comprises a hierarchy of levels corresponding to the columns in each data table. Data organized according to a plurality of dimensions may be aggregated to perform queries on the data.

BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The illustrative embodiments will be better understood after reading the following detailed description with reference to the appended drawings, in which:

[0014]FIG. 1 is a block diagram representing a general purpose computer system in which aspects of the present invention and/or portions thereof may be incorporated;

[0015]FIG. 2 is a flowchart of an illustrative business process managed by a business orchestration technology product;

[0016]FIG. 3 is a block diagram of a prior art system for modifying and storing state data corresponding to an instance of a business process;

[0017]FIG. 4 is a block diagram of a system for collecting and storing event data corresponding to an instance of a business process in accordance with one embodiment of the present invention;

[0018]FIG. 5 is a flowchart of a method for collecting and storing event data corresponding to an instance of a business process in accordance with one embodiment of the present invention;

[0019]FIG. 6 is a block diagram of an illustrative system for converting event data collected from business orchestration technology into query-able data in accordance with one embodiment of the present invention.

DETAILED DESCRIPTION

[0020] A system and method for collecting and storing event data in connection with business orchestration technology are described below with reference to the aforementioned drawings. Those skilled in the art will readily appreciate that the description given herein with respect to those drawings is for explanatory purposes only and is not intended in any way to limit the scope of the invention to the specific embodiments shown. Throughout the description, like reference numerals are employed to refer to like elements in the respective figures.

[0021] Computer Environment

[0022]FIG. 1 and the following discussion are intended to provide a brief general description of a suitable computing environment in which the present invention and/or portions thereof may be implemented. Although not required, the invention is described in the general context of computer-executable instructions, such as program modules, being executed by a computer, such as a client workstation or a server. Generally, program modules include routines, programs, objects, components, data structures and the like that perform particular tasks or implement particular abstract data types. Moreover, it should be appreciated that the invention and/or portions thereof may be practiced with other computer system configurations, including handheld devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

[0023] As shown in FIG. 1, an exemplary general purpose computing system includes a conventional personal computer 120 or the like, including a processing unit 121, a system memory 122, and a system bus 123 that couples various system components including the system memory to the processing unit 121. The system bus 123 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory includes read-only memory (ROM) 124 and random access memory (RAM) 125. A basic input/output system 126 (BIOS), containing the basic routines that help to transfer information between elements within the personal computer 120, such as during start-up, is stored in ROM 124.

[0024] The personal computer 120 may further include a hard disk drive 127 for reading from and writing to a hard disk (not shown), a magnetic disk drive 128 for reading from or writing to a removable magnetic disk 129, and an optical disk drive 130 for reading from or writing to a removable optical disk 131 such as a CD-ROM or other optical media. The hard disk drive 127, magnetic disk drive 128, and optical disk drive 130 are connected to the system bus 123 by a hard disk drive interface 132, a magnetic disk drive interface 133, and an optical drive interface 134, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, program modules and other data for the personal computer 120.

[0025] Although the exemplary environment described herein employs a hard disk, a removable magnetic disk 129, and a removable optical disk 131, it should be appreciated that other types of computer readable media which can store data that is accessible by a computer may also be used in the exemplary operating environment. Such other types of media include a magnetic cassette, a flash memory card, a digital video disk, a Bernoulli cartridge, a random access memory (RAM), a read-only memory (ROM), and the like.

[0026] A number of program modules may be stored on the hard disk, magnetic disk 129, optical disk 131, ROM 124 or RAM 125, including an operating system 135, one or more application programs 136, other program modules 137 and program data 138. A user may enter commands and information into the personal computer 120 through input devices such as a keyboard 140 and pointing device 142. Other input devices (not shown) may include a microphone, joystick, game pad, satellite disk, scanner, or the like. These and other input devices are often connected to the processing unit 121 through a serial port interface 146 that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port, or universal serial bus (USB). A monitor 147 or other type of display device is also connected to the system bus 123 via an interface, such as a video adapter 148. In addition to the monitor 147, a personal computer typically includes other peripheral output devices (not shown), such as speakers and printers. The exemplary system of FIG. 1 also includes a host adapter 155, a Small Computer System Interface (SCSI) bus 156, and an external storage device 162 connected to the SCSI bus 156.

[0027] The personal computer 120 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 149. The remote computer 149 may be another personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the personal computer 120, although only a memory storage device 150 has been illustrated in FIG. 1. The logical connections depicted in FIG. 1 include a local area network (LAN) 151 and a wide area network (WAN) 152. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets, and the Internet.

[0028] When used in a LAN networking environment, the personal computer 120 is connected to the LAN 151 through a network interface or adapter 153. When used in a WAN networking environment, the personal computer 120 typically includes a modem 154 or other means for establishing communications over the wide area network 152, such as the Internet. The modem 154, which may be internal or external, is connected to the system bus 123 via the serial port interface 146. In a networked environment, program modules depicted relative to the personal computer 120, or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

[0029] System and Method of the Present Invention

[0030] As discussed above, a business processes such as the process shown in FIG. 2 is automated using business orchestration technology such as, for example, BIZTALK server from MICROSOFT corporation of Redmond, Wash. As may be appreciated, the business process shown in FIG. 2 is for receiving and approving an application for a loan, and includes multiple services. At step 210, a business receives the application for the loan. At step 212, the business sends for an appraisal of the collateral. At step 214, the business receives the appraisal of the collateral. At step 216, the business sends for a credit history of the applicant. At step 218, the business receives the credit history of the applicant. Note that steps 212 and 216 above are performed in parallel and that steps 214 and 218 must both be completed before reaching step 220. At step 220, final approval for the loan is decided by the business. For each instance of this process, state data is modified and stored and event data is collected and stored according to the system and method described below.

[0031] Referring now to FIG. 3, the storing and modification of state data corresponding to an instance of a process may be divided between administrative groups 320 a-c. All data corresponding to a particular instance may be stored and modified by a single group 320 a-c. For example, all data corresponding to the loan application of Jim Smith may be assigned to group 320 b. The identity of each instance and its assigned administrative group 320 a-c are stored in configuration database 310. When the state of a particular instance must be changed, the configuration database 310 routes the processing to the instance's corresponding assigned group 320 a-c so that the state data corresponding to the instance can be accordingly modified and stored at the group 320 a-c.

[0032] As shown in FIG. 3, each administrative group 320 a-c comprises one or more databases 330 a-d. Data corresponding to the current state of an instance of a process is stored at the database 330 a-d in the group 320 a-c dedicated to the instance. For example, database 330 b in group 320 b may store the state data for the loan application of Jim Smith. Each database 320 a-d is dedicated to one or more servers 340-346 a-d. When an external event prompts the system to modify the state data corresponding to an instance, the state data is retrieved by a server 340 a-m in the instance's dedicated group 320 a-d so that the server 340 a-m can perform an operation to modify the state data. For example, when Jim Smith's credit report is received, server 340 g from group 320 b may perform an operation to obtain the state data from database 330 b and modify same to reflect that Smith's credit report has been received. After the operation is fully and successfully performed, the modified state data is transmitted back to database 330 b for storage thereat. If the server 340 g crashes or loses connection with the database 330 b before the operation is fully performed, then the state data is sent to another server 340 e, 340 f, or 340 h within the group 320 b to again attempt to perform the operation in its entirety.

[0033] Referring now to FIG. 4 where only group 320 a is shown, in one embodiment of the present invention an interceptor 410-416 runs on each server 340 a-d to collect event data associated with each operation to modify the state data by the server 340 a-d on which the interceptor 410-416 is running. Each interceptor 410-416 may be provisioned as hardware coupled to the server 340 a-d or as software running on the server 340 a-d. The event data collected by each interceptor 410-416 for each operation may comprise a plurality of event items. Each event item corresponds to an event such as, for example, service start, end, and error information, message in and message out metadata information, and debugging and trace data and message bodies. The event data collected by each interceptor 410-416 may consist of a standard set of event items or may consist of a set of event items that is pre-selected by a user.

[0034] The event data collected by each interceptor 410-416 is transmitted to the database 330 a for storage thereat. In one embodiment of the present invention, the transmission of the event data occurs as part of the transmission of the state data with which the event data is associated. As discussed previously with reference to FIG. 2, modified state data is transmitted from server 340 a-d to database 330 a only after the operation to modify the state data has been successfully fully performed by the server 340 a-d. Thus, and correspondingly, event data is transmitted from a server 340 a-d to database 330 a only after the operation to modify the state data associated with the event data has been successfully fully performed by the server 340 a-d.

[0035]FIG. 5 is a flowchart of a method for collecting and storing event data corresponding to modification of state data of an instance of a business process in accordance with one embodiment of the present invention. At step 510, a server 340 a-d retrieves from database 330 a state data corresponding to an instance of a process to perform an operation to modify the state data. At step 512, such server 340 a-d performs the operation to modify the state data. At step 514, and concurrently, the interceptor 410-416 corresponding to the server 340 a-d collects event data associated with the operation to modify the state data. At step 516, the server 340 a-d performs a transaction with database 330 a to store both the modified state data and the associated event data at database 330 a. Significantly, if the operation to modify the state data at step 512 has been successfully, fully performed by server 340 a-d, and if the transaction with database 330 a succeeds, both the modified state data and the associated event data are stored at database 330 a. Correspondingly, if the operation to modify the state data at step 512 by server 340 a-d fails or if the transaction with the database 330 a fails, both the modified state data and the associated event data are not stored at database 330 a. As seen, if the operation or the transaction fails, then, at step 510, another server 340 a-d receives the state data and the method is repeated until the transaction succeeds.

[0036] When the transaction at step 516 succeeds, database 330 a receives and stores the event data. Database 330 a, however, is limited in that it is not configured to analyze the event data. Instead database 330 a merely stores the event data in a serialized data stream. As should be appreciated, such serialized data stream is not a format that enables a user to easily comprehend and query the event data. Additionally, database 330 a is limited in that, because there may be more than one database 330 a-d in a group 320 a-c, as in group 320 c, event data corresponding to an instance may be divided between a plurality of the databases 330 a-d. Thus, event data stored in a data stream at each database 330 a-d must be collected and organized into a single stream and stored in a format that enables the user to easily comprehend and manipulate the data.

[0037] Referring now to FIG. 6, it is seen that databases 310 c,d in group 320 c store a stream of event data corresponding to multiple ones of the instances to which group 320 c is dedicated. In one embodiment of the present invention, each stream of event data is transmitted to tracking database 610 using a transactional reliable medium such as SQL transactional replication. Tracking database 610 collects and may organize the data stream from each database 330 c,d into a single data stream or handle each data stream separately. In addition, tracking service 620 runs at tracking database 610 to reformat the single data stream or each data stream into a query-able format that enables a user to comprehend and query the event data. In particular, tracking service 620 reads each event item in a data stream and applies a method to the event item to convert the event item into the query-able format. Of course, the method may vary depending on the query-able format, the type of event item, etc., and may be specified internal or external to the event item.

[0038] In one embodiment of the present invention, event items corresponding to an instance are organized according to a plurality of data tables, where each table represents an attribute of the data. Data may be organized according to attributes such as, for example, the time of the event item, the type of event item, and an identifier identifying each event item.

[0039] Furthermore, data may be formatted for online analytical processing (OLAP). Data formatted for OLAP is organized into a cube comprising a plurality of dimensions, wherein each dimension represents an attribute if the data. One cube may, for example, represent the event items according to instances, while another cube may represent the event items according to the operation performed. Dimensions in an OLAP cube may also be organized according to hierarchies within each attribute of the data. For example, event items may be organized according to the time at which each event occurred and grouped according to the date on which each event occurred. Data grouped according to date may also be sub-grouped according to the hour on which it occurred. Organizing data according to its attributes enables the data to be easily aggregated and queried by a user.

[0040] Thus, systems and methods for collecting and storing event data from business orchestration technology have been disclosed. These systems and methods eliminate the problem of storing “false” event items because each event item is comitted at the database only after the operation on the state data associated with the event item has been successfully, fully performed. Additionally, these systems and methods allow a user to pre-select event items corresponding to which he or she wishes to collect event data. These systems and methods also convert collected event items into a query-able format that is allows the data to be easily comprehended and queried.

[0041] While the invention has been described and illustrated with reference to specific embodiments, those skilled in the art will recognize that modifications and variations may be made without departing from the principles of the invention as described above and set forth in the following claims. For example, while the invention has been described with reference to business process orchestration technology such as the BIZTALK software application from MICROSOFT corporation of Redmond, Wash., the invention may be used in conjunction with any applicable distributed transactional application. Furthermore, the invention is not limited to the examples of query-able formats of data storage described herein. Accordingly, reference should be made to the appended claims as indicating the scope of the invention. 

We claim:
 1. A method for collecting tracking data, comprising: retrieving from a database state data corresponding to an instance of a process; performing an operation on the instance to modify the state data; collecting event data associated with the operation; and performing a single transaction with the database to store both the modified state data and the associated event data at such database, the transaction either succeeding or failing, whereby if the transaction succeeds, then both the state data and the event data are stored at the database, and if the transaction fails, then both the state data and the event data are not stored at the database.
 2. The method of claim 1, wherein retrieving state data from a database comprises retrieving at a server state data from a database.
 3. The method of claim 1, wherein performing an operation on the instance to modify the state data comprises performing at a server an operation on the instance to modify the state data.
 4. The method of claim 3, wherein collecting event data associated with the operation comprises collecting at an interceptor running on the server event data associated with the operation.
 5. The method of claim 1, wherein collecting event data comprises collecting event data corresponding to pre-selected events with regard to the transaction.
 6. The method of claim 5, wherein collecting event data corresponding to pre-selected events with regard to the transaction comprises collecting at least one of service start, service end, and service error data.
 7. The method of claim 5, wherein collecting event data corresponding to pre-selected events with regard to the transaction comprises collecting al least one of message in and message out metadata information.
 8. The method of claim 5, wherein collecting event data corresponding to pre-selected events with regard to the transaction comprises collecting at least one of debugging data, trace data, and message bodies.
 9. The method of claim 1, wherein performing a single transaction with the database comprises performing a single transaction wherein data is transmitted from a server to the database.
 10. The method of claim 1, comprising performing the single transaction only after the operation to modify the state data has been fully performed and the event data has been fully collected.
 11. A system for collecting tracking data, comprising: a database for storing state data corresponding to an instance of a process; a server for retrieving the state data from the database, performing an operation on the instance to modify the state data, and performing a single transaction with the database to store both the modified state data and the associated event data at the database, the transaction either succeeding or failing; and an interceptor for collecting the event data.
 12. The system of claim 11, wherein said interceptor comprises an interceptor running at said server.
 13. A method for converting tracking data into query-able data, comprising: receiving a stream of event data from at least one database, the stream of event data including a plurality of event items, each event item associated with one of a plurality of operations performed on one of a plurality of instances of a process; and formatting the stream of event data into query-able database by applying a method to each event item to store the event item according to the corresponding instance, whereby a current state of the instance may be obtained from the query-able database and statistics on the plurality of operations may be obtained from the query-able database.
 14. The method of claim 13, comprising receiving streams of event data from a plurality of databases and organizing the received streams of event data into a single stream.
 15. The method of claim 13, comprising formatting the stream of event data into data formatted for online analytical processing.
 16. The method of claim 13, comprising formatting the stream of event data into data organized according to a plurality of dimensions, whereby each dimension represents an attribute of the data.
 17. The method of claim 16, comprising formatting the stream of event data into data that may be organized according to a plurality of dimensions wherein one dimension in the plurality of dimensions represents a identifier identifying each event.
 18. The method of claim 16, comprising formatting the stream of event data into data that may be organized according to a plurality of dimensions wherein one dimension in the plurality of dimensions represents an event type.
 19. The method of claim 16, comprising formatting the stream of event data into data that may be organized according to a plurality of dimensions wherein one dimension in the plurality of dimensions represents an event time.
 20. A computer readable medium having stored thereon computer executable instructions implementing a method for collecting tracking data, the method comprising: retrieving from a database state data corresponding to an instance of a process; performing an operation on the instance to modify the state data; collecting event data associated with the operation; and performing a single transaction with the database to store both the modified state data and the associated event data at such database, the transaction either succeeding or failing, whereby if the transaction succeeds, then both the state data and the event data are stored at the database, and if the transaction fails, then both the state data and the event data are not stored at the database.
 21. The medium of claim 20, wherein retrieving state data from a database comprises retrieving at a server state data from a database.
 22. The medium of claim 20, wherein performing an operation on the instance to modify the state data comprises performing at a server an operation on the instance to modify the state data.
 23. The medium of claim 22, wherein collecting event data associated with the operation comprises collecting at an interceptor running on the server event data associated with the operation.
 24. The medium of claim 20, wherein collecting event data comprises collecting event data corresponding to pre-selected events with regard to the transaction.
 25. The medium of claim 24, wherein collecting event data corresponding to pre-selected events with regard to the transaction comprises collecting at least one of service start, service end, and service error data.
 26. The medium of claim 24, wherein collecting event data corresponding to pre-selected events with regard to the transaction comprises collecting al least one of message in and message out metadata information.
 27. The medium of claim 24, wherein collecting event data corresponding to pre-selected events with regard to the transaction comprises collecting at least one of debugging data, trace data, and message bodies.
 28. The medium of claim 20, wherein performing a single transaction with the database comprises performing a single transaction wherein data is transmitted from a server to the database.
 29. The medium of claim 20, wherein the method comprises performing the single transaction only after the operation to modify the state data has been fully performed and the event data has been fully collected.
 30. A computer readable medium having stored thereon computer executable instructions implementing a method for collecting tracking data, the method comprising: receiving a stream of event data from at least one database, the stream of event data including a plurality of event items, each event item associated with one of a plurality of operations performed on one of a plurality of instances of a process; and formatting the stream of event data into query-able database by applying a method to each event item to store the event item according to the corresponding instance, whereby a current state of the instance may be obtained from the query-able database and statistics on the plurality of operations may be obtained from the query-able database.
 31. The medium of claim 30, wherein the method comprises receiving streams of event data from a plurality of databases and organizing the received streams of event data into a single stream.
 32. The medium of claim 30, wherein the method comprises formatting the stream of event data into data formatted for online analytical processing.
 33. The medium of claim 30, wherein the method comprises formatting the stream of event data into data organized according to a plurality of dimensions, whereby each dimension represents an attribute of the data.
 34. The method of claim 33, comprising formatting the stream of event data into data that may be organized according to a plurality of dimensions wherein one dimension in the plurality of dimensions represents a identifier identifying each event.
 35. The medium of claim 33, wherein the method comprises formatting the stream of event data into data that may be organized according to a plurality of dimensions wherein one dimension in the plurality of dimensions represents an event type.
 36. The medium of claim 33, wherein the method comprises sing formatting the stream of event data into data that may be organized according to a plurality of dimensions wherein one dimension in the plurality of dimensions represents an event time. 